This line is in iptables
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
Do I need something more than port 53 ? it replies using telnet, but nslookup gives a timeout.
As mentioned, see http://tools.ietf.org/html/rfc5966. To properly support DNS, you need to allow port 53 for both TCP and UDP. Failure to do so will result in much higher packet fragmentation, particularly with the introduction of IPv6 and DNSSEC (note that all version of BIND since 9.2 will indicate it supports DNSSEC even if you haven't configured DNSSEC (unless you compile it out)). This particularly sucks when people filter out fragments.
DNS runs on UDP 53 not tcp 53 change your iptables rule to:
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT